A modern virus scanner’s behaviour monitoring system should be alerted at this point. The spying functionality that is downloaded once an internet connection is present comes from the free “Poison Ivy” trojan builder tool, which can provide the payload directly as shell code.

Normally, a downloader pulls an executable file from the internet, saves it on the disk, and executes it – activity that should alert a virus scanner’s behaviour monitor. This example once again shows how important it is to install a virus scanner with a behaviour monitor.